Docker Hands Sandbox Kit Spec to CNCF to Make AI Agent Permissions Portable

Docker said it will contribute its Sandbox Kit Specification to the Cloud Native Computing Foundation, a move that turns the rules governing what an AI agent can touch into a distributable artifact. The specification describes an agent's access limits as an Open Container Initiative image, so the same permission profile can be pulled, versioned and shipped alongside the agent code it constrains. Claudio Masolo reported the news for InfoQ.

The problem Docker is addressing is familiar to anyone who has deployed an autonomous agent outside a demo. Agents typically run with broad credentials — API keys, filesystem mounts, network egress — because the tooling to express narrow, machine-readable limits has been scattered across vendor-specific configs. That makes an agent's blast radius hard to audit and harder to reproduce when it moves from a developer laptop to staging to production.

By leaning on OCI, Docker is betting that the packaging format already used for container images can carry security policy too. An OCI image is content-addressable and signed, which means a sandbox definition can be pinned to a digest and verified before it runs — the same supply-chain guarantees teams already apply to their application images. In practice, an agent's allowed tools, filesystem paths and outbound endpoints would live in a layer that travels with it rather than in a README or an internal wiki.

Handing the work to the CNCF puts the spec under neutral governance, a step that matters if Docker wants rivals and cloud providers to adopt it. A single-vendor format risks the same fragmentation that has slowed other agent interoperability efforts, where competing runtimes define their own permission models. The foundation route gives competing vendors a seat at the table and a reason to implement the spec rather than route around it.

The contribution lands as enterprises move agents from pilots into production and regulators begin asking who is accountable when an autonomous system acts. Portable, inspectable permission packages give security teams something concrete to review and give auditors a record of what an agent was allowed to do at a given version. That is a narrower promise than 'safe agents', but it is the kind of plumbing that has to exist before the broader claims hold up.

What remains open is adoption and scope. Docker has not detailed a timeline for the CNCF process, and it is unclear how the spec will handle stateful agents that request new permissions mid-task or how it will map onto existing policy engines such as Open Policy Agent. The test will be whether runtime vendors and cloud platforms implement the format, or whether it becomes another well-intentioned document that ships with the agents least likely to need it.